fix: address unresolved review comments from PR #398

[Copilot]

Description

Addresses 6 unresolved review comments from PR #398: external link handling, Docker memory optimization, test clarity, API documentation, and security hardening.

Type of Change

• Bug fix (non-breaking change which fixes an issue)
• New feature (non-breaking change which adds functionality)
• Breaking change (fix or feature that would cause existing functionality to not work as expected)
• Documentation update
• Code refactoring
• Performance improvement
• Test updates

Related Issues

Relates to #398

Changes Made

External Links (build-info/page.tsx)

• Replaced Link with anchor tags for external URLs (GitHub repo, Actions runs, attestations, scorecard)
• Added rel="noopener noreferrer" security attributes

// Before
<Link href={`https://github.com/${repo}`} target="_blank">

// After
<a href={`https://github.com/${repo}`} target="_blank" rel="noopener noreferrer">

Docker Build Memory (Dockerfile)

• Added NODE_OPTIONS="--max-old-space-size=2560" to builder stage (line 86)
• Prevents OOM during Next.js compilation

API Documentation (provenance/route.ts)

• Documented commit field as legacy for backward compatibility
• Clarified IMAGE_DIGEST fallback behavior (post-build only)

Security (Dockerfile)

• Replaced SHA-1 with SHA-256 for npm tarball integrity check
• Hash: 43c653384c39617756846ad405705061a78fb6bbddb2ced57ab79fb92e8af2a7

Test Clarity (sitemap.test.ts)

• Renamed test: "should have priority hierarchy: homepage > public pages > build-info"

Version Bump

• Version automatically bumped by workflow (same-repo PRs)
• Version manually bumped using node scripts/bump-version.js (fork PRs)
• Version already up-to-date (no bump needed)

Testing

Test Environment

• Node version: 23.6.0
• npm version: 11.10.0
• OS: Ubuntu

Tests Performed

• Unit tests pass (npm run test)
• E2E tests pass (npm run test:e2e)
• Linting passes (npm run lint)
• Manual testing completed

Test Coverage

• Sitemap tests: 12/12 passing
• ESLint: No errors
• CodeQL security scan: 0 vulnerabilities

Documentation

• Documentation updated (if needed)
• Code comments added for complex logic
• API documentation updated (if API changes)

Checklist

• My code follows the project's code style
• I have performed a self-review of my code
• I have commented my code, particularly in hard-to-understand areas
• I have made corresponding changes to the documentation
• My changes generate no new warnings or errors
• I have added tests that prove my fix is effective or that my feature works
• New and existing unit tests pass locally with my changes
• Any dependent changes have been merged and published

Screenshots (if applicable)

N/A - No UI changes

Additional Notes

Changes are minimal and surgical, addressing only specific review feedback. No Tailwind CSS syntax modifications per maintainer confirmation.

---

For maintainers:

• PR title follows conventional commit format
• Version bump is correct
• All checks pass
• Documentation is complete
• Ready to merge

---

✨ Let Copilot coding agent set things up for you — coding agent works faster and does higher quality work when set up for your repo.

[Copilot]

Pull request overview

This PR addresses 6 specific unresolved review comments from PR #398, focusing on security hardening, Docker optimization, test clarity, and API documentation improvements.

Changes:

• Replaced Next.js Link components with anchor tags for external URLs and added rel="noopener noreferrer" security attributes
• Enhanced Docker security by replacing SHA-1 with SHA-256 for npm tarball integrity verification
• Added memory optimization to Docker builder stage with NODE_OPTIONS="--max-old-space-size=2560"
• Improved API documentation with inline comments explaining legacy fields and fallback behavior
• Enhanced test description for better clarity on sitemap priority hierarchy

Reviewed changes

Copilot reviewed 4 out of 4 changed files in this pull request and generated no comments.

File	Description
src/app/(public)/build-info/page.tsx	Fixed 4 external links (GitHub repo, Actions runs, attestations, scorecard) by replacing Link components with anchor tags and adding security attributes
Dockerfile	Upgraded npm integrity check from SHA-1 to SHA-256 and added Node.js memory limit to builder stage
src/app/api/provenance/route.ts	Added inline documentation comments explaining the legacy commit field and IMAGE_DIGEST fallback behavior
src/app/__tests__/sitemap.test.ts	Renamed test to explicitly describe priority hierarchy for better clarity

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.